{"id":"CVE-2026-116395","kind":"vulnerability","aliases":["CVE-2026-116395"],"related":[],"title":"LightBox Block WordPress plugin: stored XSS through version 1.2.0","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS.This issue affects LightBox Block: from n/a through 1.2.0.","summary":"The bPlugins LightBox Block plugin for WordPress does not neutralize input when generating pages, so it allows stored cross-site scripting. An attacker who can submit content that is later rendered can run script in another user's browser.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wordpress-plugins"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `lightbox-block` plugin is installed and its version is `1.2.0` or earlier, in the WordPress admin plugins list or `wp plugin get lightbox-block --field=version`\n- unknown","fix":"- Update `lightbox-block` to a version later than `1.2.0` once the vendor publishes one; the sources do not name a fixed version\n- Until a fix is available, deactivate the plugin if the lightbox block is not needed","status":"open","published_at":"2026-10-26T17:17:26+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","triaged_at":"2026-10-26T17:33:17+00:00","updated_at":"2026-10-26T17:33:17+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T17:33:17Z","model":"claude-haiku-5-5","output":{"fix":"- Update `lightbox-block` to a version later than `1.2.0` once the vendor publishes one; the sources do not name a fixed version\n- Until a fix is available, deactivate the plugin if the lightbox block is not needed","reach":"internet","title":"LightBox Block WordPress plugin: stored XSS through version 1.2.0","impact":"medium","summary":"The bPlugins LightBox Block plugin for WordPress does not neutralize input when generating pages, so it allows stored cross-site scripting. An attacker who can submit content that is later rendered can run script in another user's browser.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in other users' browsers on the site","analyst_note":"Confirm the fixed version and the privilege needed to store the payload from the NVD entry or the bPlugins/Wordfence advisory.","how_to_check":"- Check whether the `lightbox-block` plugin is installed and its version is `1.2.0` or earlier, in the WordPress admin plugins list or `wp plugin get lightbox-block --field=version`\n- unknown","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the LightBox Block plugin at version 1.2.0 or earlier are exposed, most of all where contributors or other less-trusted users can add content that is later shown to visitors or admins. Sites without the plugin installed are not affected. The sources do not say whether unauthenticated input is enough to store the payload.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000629,"input_tokens":3310,"output_tokens":596,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116395':12A,15A '-2026':11A,14A '1.2.0':9A,91C 'affect':85C 'allow':37B,81C 'anoth':57B 'attack':44B 'block':2A,24B,77C,80C,87C 'bplugin':22B,75C 'browser':60B 'content':48B 'cross':40B,70C 'cross-sit':39B,69C 'cve':10A,13A 'generat':33B,68C 'improp':61C 'input':31B,64C 'issu':84C 'later':51B 'lightbox':1A,23B,76C,79C,86C 'lightbox-block':78C 'n/a':89C 'neutral':30B,62C 'packag':16B 'page':34B,67C 'plugin':4A,20B,25B 'render':52B 'run':54B 'script':42B,55B,72C 'site':41B,71C 'store':5A,38B,82C 'submit':47B 'user':58B 'version':8A 'vulner':73C 'web':66C 'wordpress':3A,17B,19B,27B 'wordpress-plugin':18B 'xss':6A 'xss.this':83C","nicknames":[],"mitigations":[],"who_affected":"Sites running the LightBox Block plugin at version 1.2.0 or earlier are exposed, most of all where contributors or other less-trusted users can add content that is later shown to visitors or admins. Sites without the plugin installed are not affected. The sources do not say whether unauthenticated input is enough to store the payload.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T17:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116395","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116395","severity":null,"published_at":"2026-10-26T17:17:26+00:00","modified_at":"2026-10-26T17:17:26+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","fetched_at":"2026-10-26T17:31:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}